T1574 Hijack Execution Flow — ATT&CK Technique
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution. There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.
Detection coverage (13)
- Exploiting SetupComplete.cmd CVE-2019-1378 high
- Windows Spooler Service Suspicious Binary Load informational
- Potential PrintNightmare Exploitation Attempt high
- Potential Initial Access via DLL Search Order Hijacking medium
- DLL Execution Via Register-cimprovider.exe medium
- Regsvr32 DLL Execution With Uncommon Extension medium
- Potential Registry Persistence Attempt Via DbgManagedDebugger medium
- Suspicious Printer Driver Empty Manufacturer high
- Windows BitDefender Submission Wizard DLL Sideloading
- Windows Mock Trusted Directory MSC File Creation
- Windows PowerShell Module File Created
- Windows Rundll32 Execution With Log.DLL
- Windows Set Custom DNS ServerLevelPlugin Via Dnscmd